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DETAILED ACTION 

1 . This is a Final office action in response to Applicant's reply of 9/08/2009. Claims 
1-6, 9-17, 20-26 are pending. 

2. This action follows the Petition to Revive from Abandonment filed 5/21/2009 
which was approved and granted 7/28/2009. Claims are presented as amended 
9/8/2009. Remarks consistent with these amendments were filed 10/8/2009 and are the 
basis of the response herein. 



Response to Amendment 

3. In response to rejections under 35 U.S.C. 101 , Applicant amends claims to recite 
computer-implemented methods and computer-based systems, and further amends 
independent claims 1 and 10 to add a step and module for displaying the at least one 
prioritized business category and the at least one total risk score . However, these 
amendments do not fully address the deficiencies under 35 U.S.C. 101 : 

As to the process claims 1-6, 9, and 21-26, nominal recitation of a "computer" (or 
network) in a process claim, even if explicitly reciting the computer in a claim, does not 
in itself result in patentability of an otherwise ineligible computer-implemented invention. 
Insignificant extra-solution activity such as data gathering, data output, transmitting or 
display, does not transform an unpatentable process into a patentable process. For 
example, claim 1 recites steps of presenting, via a computer network, ... and prioritizing, 
via the computer network, ... however, presenting and prioritizing, via the computer 
network, and displaying are mere pre- and post-solution activity (data gathering and 
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display) noting that as disclosed there is no prioritizing being performed by the computer 
network, only data gathering via the computer network. Because no step of the process 
recites a particular apparatus performing significant step(s) of the process, the claim 
remains ineligible for patenting and thus non-statutory under 35 U.S.C. 1 01 . 

Claims 10-17 and 20 reciting a computer-based system... recites a system 
without structure and further, even inferring the existence of a "computer" in the system 
from the preamble, recites "modules" and an "engine" disclosed as software but are not 
tied in the claim to any computer or apparatus for performing the software. As such, the 
claims recite software per se without relation to any structure and are similarly non- 
statutory under 35 U.S.C. 1 01 . 

Examiner suggests that the methods claims amended to recite the determining... 
steps as being also performed bv a/the computer would meet the statutory machine-or- 
transformation test for process claims, and amending the system claims as comprising 
a processor and a memory with the modules stored thereon for executed by a computer 
would be statutory as to the apparatus claims. Examiner notes support in the 
specification for these embodiments at Figures 3-4 and pages 15-16, disclosing a 
computer (server or client stations) and system for performing the disclosed methods. 
However, presently, the claims remain non-statutory under 35 U.S.C. 101 . 
4. Applicant amends claim 25 to address a rejection as to indefiniteness under 35 
U.S.C 1 12, as to the word directly further limited the invention. The removal of directly 
from the claim along with Applicant's explanation of its intent interpretation provides 
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sufficient clarity to the claim, and, accordingly, the rejection under 35 U.S.C. 112 is 
withdrawn. 

Response to Arguments 

5. Applicant's arguments filed 10/9/2008 have been fully considered but they are 
not persuasive: 

Applicant argues Barton (US Pat. Pub. 2002/0059093) "does not teach as in 
claim 1 , determining a detection index based on the number of response, and 
corresponding answers, to each of the series of questions as recited in claim 1," 
because "Barton teaches... compiling answers received from the process owners, and 
summarizes the questions and answers as an assessment of the compliance program," 
which is not "determining a detection index based on the number of responses and 
corresponding answers." (Remarks, pg. 9, 2 nd para.). Applicant asserts that Barton's 
detection index is instead based on a "detect ability" and not on "the number of 
responses and corresponding answers," (Remarks, pg. 10, 1 st paragraph). 

Applicant further argues Barton's "occurrence factor" is not the same as the 
occurrence index of the present invention, because the occurrence index of claim 1 is 
"based on the potential consequences of non-compliances, e.g., potential number of 
non-compliance and its impact," whereas Barton's occurrence factor is "based on 
percentages," which are in Barton, if Examiner's understanding of the distinction argued 
by Applicant is correct, percentages or a "likelihood" of non-compliance in a process; 
that is, based on a probability of non-compliance and not based on the potential 
consequences of non-compliance as recited in claim 1 . (Remarks, pg. 10, 2 nd -4 th para.). 
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Applicant argues the rejection of claims 23 and 24 under 35 U.S.C. 103(a) are 
deficient for at least the reasons given above for claim 1 (Remarks ,pg. 1 1 ). 

In response to Applicant's considered analysis and response to rejections over 
Barton, Examiner respectfully disagrees. 

Applicant is reminded that claims on examination are given their broadest 
reasonable interpretation in light of, but not reading into to the claim details of, the 
specification. 

Barton teaches a detection index which is "based on" the number of responses 
and corresponding answers. Prior to building the risk model and determining the 
assignments of risk ratings in the FMEA matrix (see 1J0084]), Barton performs a risk 
assessment based on the questionnaires to produce an analysis of compliance from 
which "results from the questionnaires are a key input in mapping high level business 
risk model." (^[0069]). The output of this analysis which is based on a "ratio of the 
number of questions for which an answer was expected" fl|[[0065]) is used to assess 
the detect-ability and assign the detection factor used in the overall assessment (see 
1J[0085]). Thus, at least indirectly Barton teaches a detection index (factor) which is 
based on the number of responses and corresponding answers. 

As to distinctions argued in the occurrence index of the present invention, 
Examiner notes that the occurrence index is claimed as one based on the potential 
consequences of non-compliance, not, as argued, as "based on the total number of 
agents and/or employees affected by non-compliance" (see Remarks, pg. 10, 2nd 
paragraph). Barton teaches an occurrence index as a likelihood of occurrence of non- 
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compliance; the "occurrence" of an instance of non-compliance is, broadly, a potential 
consequence of non-compliance (i.e. "it happened"). In response to applicant's 
argument that the references fail to show the argued features (number of agents or 
employees affected), notwithstanding that said features are non specifically claimed, 
Barton's "likelihood of occurrence" factor is at least indirectly related to the occurrence 
index of the present invention as one would anticipate the likelihood of occurrence to 
increase with the increased opportunity of non-compliance by greater numbers of 
employees. 

6. Accordingly, the grounds of rejection over all claims as in the prior office action 
are maintained. 



Claim Rejections - 35 USC § 101 

7. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

8. Claims 1-6, 9, and 21-26 are rejected under 35 U.S.C. 101 based on Supreme 

Court precedent, and recent Federal Circuit decisions. 

For a process to be patentable subject matter under § 101 the process must also (1) be tied to a 
particular machine or apparatus, or (2) transform a particular article to a different state or thing. 
See Diamond v. Diehr, 450 US 175, 184 (1981); Parker v Flook, 437 US 584, 588 n9 (1978); 
Gottschalk v. Benson, 409 U.S. 63, 70 (1972); Cochrane v. Deener, 94 US 780, 787-88 (1876). If 
neither of these requirements is met by the claim, the method is not a patent eligible process. To 
be "tied" to a particular machine or apparatus, the use of the machine or apparatus in the claimed 
process must impose a meaningful limit on the claim's scope, and the use of the particular 
machine or apparatus must involve more than insignificant extra-solution activity. Insignificant 
extra-solution activity means activity that is not central to the purpose of the invention. 
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In the present case, claims 1 and 24 recite: A computer-implemented method for 
use in compliance management, comprising... presenting...; soliciting...; determining...; 
and prioritizing, each via a computer network. However, mere recitation of an 
apparatus or article in the preamble of a claim does not transform an unpatentable 
process into a patentable process, and nominal recitation in trivial or incidental steps of 
a process claim does not constitute a sufficient tie to a particular apparatus. 

In the present case, none of method (process) claims are tied to a particular 
machine or apparatus, or transform a particular article to a different state or thing. 
Reciting a computer-implemented method in the preamble and a data gathering step 
performed via a computer network in the body of the claim, does not create a sufficient 
tie to a particular apparatus because the presenting, soliciting, and prioritizing, via a 
computer network merely recite data presentation, data gathering, and transmitting 
steps, and no substantive step is recited as being performed by a computer. Lacking a 
sufficient tie to another statutory class, the claims are nonstatutory subject matter and 
therefore ineligible for patenting. 

Appropriate amendment is required. 

9. Claim 10-17 and 20 are rejected under 35 U.S.C. 101 because the claimed 
invention is directed to non-statutory subject matter. Claim 10 recites: A system for use 
in compliance management, comprising: a query module...; and a prioritization 
module... However, a system without structure where the components of the system 
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are disclosed as computer software per se is non-statutory per se. Claims 11-17 and 
29 depend from claim 10 and are similarly deficient. 
Appropriate amendment is required. 

Claim Rejections - 35 USC § 102 

4. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 1 02 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1 ) an application for patent, published under section 1 22(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

5. Claims 1-6, 9-17, 20, 22, and 25-26 are rejected under 35 U.S.C. 102(e) as being 
anticipated by Barton et al. (U.S. 2002/0059093). 

As per claim 1 , Barton et al. teaches a method for use in compliance 
management, comprising: 

presenting, via a computer network, a user with a series of questions relating to 
at least one business category (See figure 11, paragraphs 0010, 0012-0014, 0049, 
0051, wherein questions are presented via the network concerning compliance risk); 

soliciting, via the computer network, a response from the user for each question 
presented (See paragraphs 0010, 0012-0014, 0049, 0051, 0060, wherein the questions 
are answered); 
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determining a detection index based on the number of responses and 
corresponding answers to each of the series of questions (See paragraphs 0013-0014, 
0060, 0081 , and 0084, wherein detection is determined based on the responses 
received (and there answers) to a questionnaire. The system tracks when responses 
are received. The answers corresponding to the questions are used to perform 
calculations); 

determining an occurrence index based on the potential consequence of non- 
compliance (See paragraphs 0007, 0081 , and 0084, wherein occurrence index is 
determined); 

determining a standard severity risk index based on the expected severity of non- 
compliance (See paragraphs 0068, 0072-3, 0075, 0081, 0084, wherein severity indexes 
are considered); and 

prioritizing, via the computer network, the at least one business category based 
on the user's responses and at least one total risk score comprising the product of the 
detection, occurrence, and standard severity risk indices (See paragraphs 0081, 0084- 
0087, wherein a risk score is calculated based on these factors. See also paragraphs 
0068-0069, 0072, 0081, 0090-0091 , where risk prioritization numbers are generated to 
determine the order to handle the risk areas of the business); 

and displaying... the prioritized risk score (see Figure 17). 

As per claim 2, Barton et al. discloses wherein the user response comprises a 
"Yes" or "No" (See paragraphs 0060 and 0064, wherein the questions are answered 
yes/no). 
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As per claim 3, Barton et al. discloses wherein the at least one standard severity 
risk index comprises a number between 1 and 10 corresponding to a specific level of 
risk (See paragraph 0060, 0068, 0072-0075, wherein severity is valued 1-10). 

As per claim 4, Barton et al. discloses wherein the number "1" comprises the 
lowest level of risk severity, and the number "10" the highest level of severity (See 
paragraph 0060, 0068, 0072-0075, wherein 1 is low and 10 is high severity). 

As per claim 5, Barton et al. teaches wherein the at least one standard severity 
risk index corresponds to the at least one business category (See paragraph 0040, 
0060, 0068, 0072-0075, which corresponds to at least one business category. See also 
figure 11). 

As per claim 6, Barton et al. discloses the step of determining a detection index 
based on the user's responses, and the number of users (See paragraphs 0065 and 
0084, wherein the detection index is determined based on the responses from the at 
least one user). Barton et al. also generates a score based on the number of questions 
presented (i.e. "opps") (See paragraphs 0065 and 0084, where the number of questions 
presented (i.e. opportunities) are used to determine a score). 

As per claim 9, Barton et al. teaches ranking the at least one business category 
based on the at least one total risk score (See paragraphs 0081 , 0084-0087, wherein a 
risk score is calculated. See also paragraphs 0068-9, 0072-0075, 0081 , 0090-0091 , 
where risk is prioritized). 

As per claim 10, Barton et al. teaches a system for use in compliance 
management, comprising: 
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a query module associated with an engine for presenting at least one user with a 
series of questions relating to at least one business category, and for soliciting and 
receiving responses from the at least one user for each question presented (See figure 
11, paragraphs 0010, 0012-0014, 0049, 0051, 0060, wherein questions are presented 
via the network concerning compliance risk and answers are received);; 

a prioritization module associated with the engine for: (1) determining a detection 
index based on the number of responses to each of the series of questions, determining 
an occurrence index based on the potential consequence of non-compliance, and 
determining a standard severity risk index based on the expected severity of non- 
compliances (See paragraphs 0068, 0072-0073, 0075, 0081, 0084, wherein a detection, 
occurrence, and severity index are determined) and (2) prioritizing the at least one 
business category based on the at least one user's responses and at least one total risk 
score comprising the product of a detection, occurrence and standard severity risk 
indices (See paragraphs 0081 , 0084-0087, wherein a risk score is calculated based on 
these factors. See also paragraphs 0068-0069, 0072, 0081 , 0090-0091 , where risk 
prioritization numbers are generated to determine the order to handle the risk areas of 
the business). 

As per claim 1 1 , Barton et al. teaches wherein the series of questions are 
presented to the user over a communications network (See figure 1 1 , paragraphs 0010, 
0012-4, 0049, 0051, and 0060, wherein questions are presented via the network). 

As per claim 12, Barton et al. teaches wherein an administration module 
associated with the engine for inputting, updating and accessing data associated with 



Application/Control Number: Page 12 

10/022,438 

Art Unit: 2121 

the query and prioritization modules, the administration module being accessible to an 
administrator of the system via an administration interface (See paragraphs 0012-3, 
0048-51, 0060, 0064, wherein an administrator and interface is disclosed). 

Claims 13-17 and 20 recite equivalent limitations to claims 2-6 and 9, 
respectively, and are therefore rejected using the same art and rationale as applied 
above. 

As per claim 22, Barton et al. teaches wherein the occurrence index weighs the 
total risk score based on the potential consequences of non-compliance (See 
paragraphs 0081 , 0084-0087, wherein a risk score is calculated based on these factors, 
and wherein occurrence influences and affects the overall score. See also paragraphs 
0072 and 0075). 

As per claim 25, claim 25 is rejected using the same art and rationale set forth 
above with respect to claim 21 . Barton et al. further discloses assessing a potential 
consequence of non-compliance, the potential consequence of non-compliance relating 
to parameters and the values of such parameters (See figure 16 and paragraphs 7, 38, 
42, 44, 55, that disclose potential consequences (failure effects) of failures of non- 
compliance); determining an occurrence index based on the potential consequence of 
non-compliance that was assessed, such that the occurrence index changes as the 
parameters associated with the potential consequence of non-compliance change, the 
occurrence index that is determined being one of at least three possible occurrence 
indices, the at least three possible occurrence indices being provided as possible 
occurrence indices (See figure 16 and paragraphs 81 and 84, which disclose an 
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occurrence index that results from the identified potential failures and the failure's 
effects. The occurrence index can be chosen from a set of 1-10). 

As per claim 26, Barton et al. teaches wherein the detection index by a 
relationship between the number of queries or questions that were answered with a 
particular response, the total number of queries or questions in the category, and the 
number of departments or units responding (See paragraphs 001 0, 001 2-001 4, 0049, 
0051 , 0060, wherein the questions are answered. Paragraphs 56-9, 62, 72, and 90, 
specifically discuss the gathering of information from interviews and questionnaires into 
the knowledge base of the system. This knowledge base is relied upon to determine 
the detection index. See specifically paragraphs 0081 and 0084, wherein detection is 
determined using the knowledge base). 

Claim Rejections - 35 USC § 103 

6. The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

7. Claims 23-24 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Barton et al. (U.S. 2002/0059093). 

As per claims 23 and 24, Barton et al. teaches the potential consequence of non- 
compliance (See paragraphs 0081 and 0084-0086). However, Barton et al. does not 
expressly disclose that the potential consequence of non-compliance is based on the 
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total number of agents or employees affected by non-compliance or the total number of 
policies in force. 

Barton et al. discloses that the potential consequence of non-compliance, which 
is considered in the system when determining an occurrence index. It is old and well 
known in the art that employees and the number of policies are factors that cause 
occurrences of non-compliance, such as a regulation being violated by a policy or an 
employee not following a rule. Therefore, it would have been obvious to one of ordinary 
skill in the art at the time of the invention to consider employees affected by non- 
compliance and the total number of policies in force in the occurrence index when 
considering the potential consequence of non-compliance in Barton et al. in order to 
more efficiently determine the potential for failure concerning the business by taking into 
account the areas in which non-compliance events may occur. See paragraphs 0065 
and 0084. 

Conclusion 

1 0. The prior art made of record and listed on the attached PTO Form 892 but not 
relied upon is considered pertinent to applicant's disclosure. 

Specifically, Buddie et al. (JP 2001250023 A) published Sept. 14, 2001 in 
Japanese and prior to the priority date of the present invention and related by patent 
family to US Pat. 6,912,502 issued in 2005 to an assignee common to the present 
invention, appears to disclose the present invention at least as claimed, however, 
Buddie et al. does not list the present applicant as an inventor. Furthermore, while the 
translated contents of Buddie et. al. (in Japanese) are presently unverified, Buddie et al. 
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(US Pat. 6,912,502) expressly discloses an "occurrence score [based on] a measure of 
how frequently the risk [of non-compliance] could occur... driven by responses to a 
number of key questions (e.g. how many employees or distributors the company has or 
the total number of policies in-force)" and a "detection score driven by the responses to 
the questionnaire." (see Buddie, column 8, lines 44-50). Though not presently applied 
in any rejection, the two Buddie references raise questions as to inventorship and 
finding a consistent translation of the Japanese publication, may qualify as 102(a) prior 
art in a future rejection. 

Applicant is also advised to consider in detail the additional patent and non- 
patent prior art cited on the 892 attached in preparing any amendment and/or response 
to this office action. 
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Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Dave Robertson whose telephone number is (571)272- 
8220. The examiner can normally be reached on 8 am to 6 pm, M-F. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Albert Decady can be reached on (571) 272-3819. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

/Dave Robertson/ 
Examiner, Art Unit 3623 

/Ramesh B. Patel/ 

for Albert Decady, SPE of Art Unit 2121 



